Astra Linux – Vulnerability in emacs

org-babel-execute: latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...

Astra Linux – Vulnerability in sssd

A flaw was discovered in SSSD, where the sssctl command was vulnerable to shell command injection through the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into executing a specially crafted sssctl command, such as using sudo, in order to gain root...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 item key “smart.disk.get” does not sanitize its parameters before passing them to a shell command, which may lead to a vulnerability for remote code execution...

Astra Linux – Vulnerability in xorg-server

A heap buffer overflow flaw was discovered in the DisableDevice function of the X.Org server. This issue may cause an application to crash, or in some cases, lead to remote code execution in SSH X11 forwarding environments...

Astra Linux – Vulnerability in Gegl

The loadcache function in GEGL before version 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This issue arises due to the use of the system library function for executing the ImageMagick convert fallback in magick-load. NOTE: GEGL versions...

Astra Linux – Vulnerability in OpenSSH

In SSH in OpenSSH before version 9.6, OS command injection could occur if a user name or host name contained shell metacharacters, and this name was referenced by an expansion token in certain situations. For example, a untrusted Git repository might contain a submodule with shell metacharacters ...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH versions prior to 10.3, command execution could occur through shell metacharacters within a username in a command line. This requires a scenario where the username on the command line is untrusted, and also requires non-default configurations of % in sshconfig...

Astra Linux – Vulnerability in Vim

Vim is an open-source, command-line text editor. Prior to version 9.2.0073, there was a vulnerability related to OS command injection in the netrw standard plugin bundled with Vim. By forcing a user to open a specially crafted URL e.g., using the scp:// protocol handler, an attacker could execute...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the “print command” setting via the “%J” substitution character, without escaping shell meta characters. A remote attacker could exploit this vulnerabili...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to an unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled which is the default when not explicitl...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...

Astra Linux – Vulnerability in libnbd

A flaw was discovered in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier URI. This vulnerability arises because non-standard hostnames starting with ‘-o’ are incorrectly interpreted as arguments for the Secure Shell SSH...

Astra Linux – Vulnerability in Less

Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

EUVD-2026-77442

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

Astra Linux – Vulnerability in Golang-1.19

The command go env command is documented as outputting a shell script containing the Go environment. However, go env does not sanitize the values it outputs. Therefore, executing its output as a shell script can lead to various malicious behaviors, including executing arbitrary commands or...

Astra Linux – Vulnerability in Git

Git is an open-source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git’s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits comman...

Astra Linux – Vulnerability in snmptt

Before version 1.4.2 of SNMPTT, attackers could execute shell code through EXEC, PREXEC, or unknowntrapexec...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method. This vulnerability occurs when the $sourceReference parameter is appended to a shell command without proper escaping...